# REPORT — a backup is never changed by a new install, a restore downloads first, a restore tells the truth (2026-10-25, unattended; commit only, NOT released)

Brief: operator rulings D47 and D48 (2026-10-25 08:38); fix R-1269, D48, R-1270, R-1271; red-proof each; live-prove on
9202; nothing released — rides v0.343.0 (MinAgent 0.158.1 unchanged). Full record: felhom.eu
`documentation/audits/restore-truth-2026-10-25/README.md`.

## What changed (each commit pushed; CI green by hash)

| commit | CI job | what |
|---|---|---|
| `02daebe` | 2311 | **D47 / R-1269:** `stacks.AppConfig.InstallID`; `backup/unit_owner.go` — every unit writer sets another install's unit aside whole (`backups/set-aside/<app>/<stamp>`, a kept copy kind `unit`); the restore page „Visszaállítás" on it (`POST /backup/kept/restore`); remove with backups deletes it |
| `b680db8` | 2312 | **R-1270:** `backup/restore_verdict.go` — `ErrRestoreNotStarted` on every restore path; undo copy kept; late-start watcher; one operator line |
| `2d71270` | 2313 | **D48:** `backup/restore_pull.go` — `prepareRestoreImages` before the stop on every restore path, under `dockerexec.HoldImageWork` |
| `bd9f4f7` | 2314 | **R-1271:** `keptPick` / `KeptNewerAt` — a copy > 10 min in the future is never the newest; alone it is offered, said, not recommended |
| `1f9c863` | 2315 | D47 follow-up (found live): the kept-copies list shows on a box without off-site too |
| `1f82959` | 2316 | R-1270 follow-up (found live): remove with backups deletes `backups/restore-undo/<app>` |

## Red-proofs (each test seen failing with its fix switched off)

felhom.eu `audits/restore-truth-2026-10-25/redproof/`: `d47-guard-off.txt` (6 of 8 fail), `d47-stacks-adopt-off.txt`,
`d47-web-form-off.txt`, `d47-kept-list-without-offsite.txt`, `r1270-warn-only.txt` (3 of 5), `r1270-web.txt`,
`d48-no-prepull.txt` (5 of 6), `r1271-future-ignored.txt` (4), `remove-undo-copy-before.txt`.

## Live proofs (9202, `0.343.0-rc.1` then `-rc.2`; back on 0.342.0 at the end)

Before on 0.342.0 (= `e1613ae` for these files): the kept unit rewritten, the restore `ok: true` over `starting`, 44 + 23
password errors. After: Tandoor and AdventureLog — set aside byte for byte, restored with the old password, the item
back, 0 errors; Vikunja — an unpullable pin refused with the container never restarted, an exiting image recorded
`not_started`; RomM — the own copy chosen over a forged future-dated one, which alone was offered and marked.

## Not done here, filed

R-1278 (a volume app's reinstall does not offer its kept backup), R-1279 (the `.fab` import removes volumes before its pull).